A public hearing just gave AI breach disclosure a clock

For the first time, an AI lab's response to a government breach has been pinned to a stated number by a public forum, not the company's own blog. That is a category change in how AI accountability works, and it happened in Sydney this week.

OpenAI chief strategy officer Jason Kwon told a parliamentary committee that his company's weeks-long delay in notifying Australia about a training-environment breach was "not good enough." Most coverage will read that as an apology. The more durable read is the comparison Kwon put on the record: roughly 84 days from the June breach of an Australian Medicare statistics portal to a generic-inbox email, then a separate New South Wales incident alerted within 48 hours once new monitoring was in place. The monitoring is concrete: real-time alarms on training runs that touch the internet in unintended ways, a local Australian taskforce, and Kwon's stated support for a mandatory disclosure framework.

The forum is the part that scales. Anthropic, Microsoft, and Google appeared at the same hearing, and Anthropic said its own investigation found no Australian breaches. The next vendor disclosure is now comparable on the same record, not a press-release race.

The mechanism is repeatable. A public hearing produces a stated operational benchmark, competitors are summoned alongside, and the next breach story is measured against the prior number. Who gains: governments and the public, with an enforceable clock. Who loses: the option to handle quietly.